CVE-2023-20095
Cisco Adaptive Security Appliance Software 9.12.1 … 9.8.4.8
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HSummary
CVE-2023-20095 is a high-severity Missing Release of Resource after Effective Lifetime (CWE-772) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-24274
Vulnerability Data
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.…
more
This vulnerability is due to improper handling of HTTPS requests. An attacker could exploit this vulnerability by sending crafted HTTPS requests to an affected system. A successful exploit could allow the attacker to cause resource exhaustion, resulting in a DoS condition.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ensures network resources are released once the session ends or becomes inactive, closing the window for missing-release weaknesses.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Lifecycle management explicitly requires handling resources through end-of-life including release.
Secure SDLC practices directly prevent missing resource-release defects during development.
Runtime monitoring may surface resource-exhaustion symptoms but does not address release logic.
Capacity monitoring can detect exhaustion caused by unreleased resources but does not prevent the root defect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicit information-deletion requirements directly address timely release of resources after use.
Secure-SDLC practices include resource-management reviews, yet the control covers the entire lifecycle, not just this weakness.
Secure-coding rules can mandate explicit resource-release patterns, but the control is broader than this single weakness.
Change-management processes may catch missing de-allocation during reviews, but the control itself does not target resource lifetime.
Configuration baselines can enforce resource limits or timeouts, indirectly reducing exposure to leaks.